Two things about banking 2FA.

One: the "second factor" lives on the same phone as the banking app. The regulator says that's fine, as long as the apps are sandboxed from each other.

Two: every login greets me with a phishing warning I've long stopped reading. Not laziness — repetition switches attention off; you can watch it happen in a brain scanner.

But that's not a bug from the bank's side. The warning isn't there to protect me. It's there to prove they warned me. Informed — not effectively, but informed. And when something goes wrong, guess whose fault the click was.